Phishing/smishing/vishing

M

MauleSkinner

Touchdown! Greaser!
Joined
Oct 25, 2005
Messages
21,670
Location
Wichita, KS
Display Name
MauleSkinner
So I’m doing my annual training on avoiding being a victim of phishing/smishing/vishing.

On Friday afternoon, I get a call from a mobile phone that I don’t recognize, and a voice mail from someone I do recognize (voice and all) as the HR guy who was in the building when I was hired, but is no longer. He says they’ve sent an email regarding some employment documentation that is missing.

Friday was a day off, so I check my email this morning when I get to work, and I see an email from someone whose name I don’t recognize, saying that an audit shows some of my personal information missing, that they have contracted with a third party to collect the information, and that I should click the link in the email to schedule my appointment within the next 48 hours.

Shortly after opening the email, I get another call from HR guy, informing me that the email is real, not phishing, and it’s ok to click on the link. They need the link click/scheduling done by tomorrow.

What part of this DOESN’T stink like last week’s fish?

Im 99% sure this is real…just waiting on verification that HR Guy still works for the company. But why in the hell do these people always violate the rules for the stuff that they require us to train on? (This is not an uncommon occurrence…just the most egregious so far.)

Edit: talked to the Big Boss in the building…I’m now 100% sure it’s legit, but he agrees that their handling was crappy.
 
Last edited:
We used to get an official looking email that says your laptop is due to be upgraded. We got new ones about every two years. They sent one with a link which if you clicked on it you got a warning that you fell for a potential scam. Think about 50% of people clicked on it as new laptops were a very much wanted.

@MauleSkinner , Agree and I would have been very suspicious as well.
 
The state of colorado requires all employees (including everyone at the universities) to take cyber security course every year. Including those of us who not only teach it, but do consulting in the field on the side (perfectly legal as long as we inform the school). Most of the time we're taking notes on what's wrong with the required course.
 
haha, this hits home.
My old company violated their own rules. They'd put us through that IT compliance training type stuff, teaching you to be super diligent about whom you trust.
But as part of our corporate culture we did a lot of mandatory informal polls and surveys. That was great, except the company was too ****ing cheap to pay for a real survey host. So we just bounced between free providers.

And because of that we'd get messages like this:
Subject: "Vote NOW for the Q3 TOWN HALL DISCUSSION TOPICS!!!!"
From: [email protected]
Message Send Time: 3:17 AM
URL: www.definitelynotmalware.com/Survey/trustme/totallySAFE/JUSTCLICKIT/survey.html?exploitUserData=True&deliverRansomware=True&safeLink=0&getBitcoinWalletAddress=1

Even our spam filters screamed bloody murder half the time.

Then we'd get a blanket message from HR about a week later remind us all we haven't voted yet. So you'd just sort of press on the link and pray.
 
Last two companies I worked for would send out emails with links to click on for mandatory security training. Nothing on the IT or HR pages etc. so you could check. Just trust the email and log in with your company ID / password.
 
Worked for a startup company about 25 years ago, back when the virus/spam stuff was just getting going. Some outsider sent a link to the entire company (not sure how). Being a suspicious SOB even back then, I didn't open it. But you could track the progress of the virus through the office, as one computer after another shouted, "I'M WATCHING CHILD PORN! I'M WATCHING CHILD PORN!"....

Ron Wanttaja
 
wanttaja said:
Worked for a startup company about 25 years ago, back when the virus/spam stuff was just getting going. Some outsider sent a link to the entire company (not sure how). Being a suspicious SOB even back then, I didn't open it. But you could track the progress of the virus through the office, as one computer after another shouted, "I'M WATCHING CHILD PORN! I'M WATCHING CHILD PORN!"....

Ron Wanttaja
Click to expand...
Imagine being the poor salesperson walking clients around the office when that computer epidemic hits. Having to reassure them that not everyone working at the building is a sexual predator.
 
wanttaja said:
Worked for a startup company about 25 years ago, back when the virus/spam stuff was just getting going. Some outsider sent a link to the entire company (not sure how). Being a suspicious SOB even back then, I didn't open it. But you could track the progress of the virus through the office, as one computer after another shouted, "I'M WATCHING CHILD PORN! I'M WATCHING CHILD PORN!"....

Ron Wanttaja
Click to expand...
I think I’m going to suggest this to IT for the next phishing test…
 
Funny. I got the "hardware refresh" phishing email test our Corp sent out today. My lead engineer said he almost fell for it cause it's about time for his laptop refresh!
I got a $10 gift card last year for passing all the tests throughout the year, but I suspect I'll only get the subscription to the Jelly of the Month club this year as I reported an email as phishing that was only spam. My bad corporate, my bad.
 
baboss said:
Funny. I got the "hardware refresh" phishing email test our Corp sent out today. My lead engineer said he almost fell for it cause it's about time for his laptop refresh!
I got a $10 gift card last year for passing all the tests throughout the year, but I suspect I'll only get the subscription to the Jelly of the Month club this year as I reported an email as phishing that was only spam. My bad corporate, my bad.
Click to expand...
I’ve been known to report emails from the company president as phishing…”you can click on the link below, it’s safe.”
 
The worst part is when you ignore the "you have a package" email just to find out this one is the one legit email and u have less than a day to retrieve it before the mailroom returns it. And it looked even spammier than the spam emails.
 
Heh. Way back in the day we got our first voicemail system where I used to work. It allowed you to forward voicemails. It didn’t take long before one message popped up, and I still remember it: “This is Dr Gupta from the free clinic. We got your test results back and you should come in before parts of you start falling off.” It got copied and forwarded so much it started to crash the system. We all got a memo from upstairs the next day to knock it off.
 
At my long time HugeGloboBank, we were of course forced to take the mandatory training every year. Security, anti-corruption, anti money laundering, D&I, the list got longer as the years wore on. It only annoyed me becuase most of it was applicable to sales driods and customer-facing people, and I couldn't have been further from that. They regularly did phishing tests, but they were so easy to spot I wondered how anyone could actually fall for them. I was "in IT", but that phrase covered probably between 50K and 100K people so nobody asked me about any of it.

Then I joined my follow-on TinyLittleStartupBank. Great, I thought, as Grand Exalted Mystic Poobah of IT, maybe I can nudge some of it in a more reasonable direction! Nope. All of that crap was generated by Info Security and HR. The only positive was that, as we were small and I was high enough in the pecking order, I could pretty much ignore all of it. The managers who might have been b****ing were all my peers, we knew and liked each other, and they were all dependent upon my teams...
 
I had a client that was a very recognizable F500 company. This was back in the day when getting internet access over the company network was a big thing. We were using dial up in a conference room for the team, which meant we needed rotate who had access so we could keep up with emails. I finally talked the CIO in to letting us connect to the company network. That was done and less than 24 hours later, he stormed into our conference room and ripped me a new one for crashing his network due to us infecting it with a virus. I was pretty sure it wasn't us and pushed back pretty hard. A day later we found out that an employee was surfing porn in his office ALL DAY LONG, averaging 1 click every 12 seconds on porn sites. That was the last time that CIO got in my face.
 
when we bought this house the bank had someone send a follow up asking for a ton on personal info they already had. I called the bank and shared the email. It was apparently legit - spelling and grammar errors and all. They apologized saying it was someone new …. Amazing.
 
Ha! You boys should try logging in the FAA websites. It used to be a simple username/password. A couple years ago they changed to a "MyAccess" platform, forcing everyone to use 2-factor authentication with either phone codes or code generator apps. They've changed it again, now you have to go through a unified .gov website that forces you to take pictures of your ID and enter your SSN in order yo confirm your identity. Or you go to a post office to conform it in person.
All that in order to take some FAA-mandated training. YHGTBSM.
 
AV8R_87 said:
Ha! You boys should try logging in the FAA websites. It used to be a simple username/password. A couple years ago they changed to a "MyAccess" platform, forcing everyone to use 2-factor authentication with either phone codes or code generator apps. They've changed it again, now you have to go through a unified .gov website that forces you to take pictures of your ID and enter your SSN in order yo confirm your identity. Or you go to a post office to conform it in person.
All that in order to take some FAA-mandated training. YHGTBSM.
Click to expand...
Oh, it gets better…I got the login.gov access a couple of years ago for SSA.gov access, and it’s now required for the designee website. Guess what? It doesn’t work, and the Feds can’t seem to figure out why.
 
The worst we had was some dumba** that hit Reply All to an all hands email....over 115k people, then the idiots that hit Reply All to that one. More than 8 million internal emails within about 4 hours and the system crashed. Took IT about two days to clear it all out and restore everyones access.
 
Yeah, people in the industry think we have a user training problem. We do not. We have a horrible IT system problem, across nearly every industry. Someone that used to work in info sec in the CIA pointed that out 10+ years ago at an area cyber conference, and nobody wanted to hear it.

Rewind back to about 1980, when people using computers in hospitals were using green or white screen terminals to access the mainframe. Now tell the managers of that hospital that soon almost every employee in that building would have their very own computer, and they'd be able to install just about any piece of software they wanted to. You'd get people telling you that you were nuts. Yet that's where we're at now. Most businesses, most places, anyone can click on the wrong link or install the wrong USB on their computer and risk taking down an entire enterprise. Or maybe just end up watching a video of a rabbit.

We don't have a problem with employees. We have a problem with an infrastructure that's so damn fragile that people can break it by accident.

To those IT guys where the employees have appliances or Chromebooks running web apps, I apologize.

I won't do the identity problem rant. It's too long and less upbeat.
 
Tools and management systems do exist to prevent users from installing software and to keep things up to date, but they’re expensive. Not only is the licensing expensive, but you need trained people to run them. It still won’t stop people from being tricked into leaking information, or doing it intentionally, or inadvertently giving away access to people who shouldn’t have it.

I used both Microsoft’s tools (Intune or whatever its name is this month) and Apple’s answer (which doesn’t come from Apple; you have to buy Jamf or Kandji or whatever). Both suck. Then we had numerous other tools that all had agents installed for security.

And none of it prevents your “people team” from hiring a fake person who turns out to be remotely operating one of your company laptops from North Korea, where their salary ends up supporting Dear Leader’s regime.
 
My company is a defense contractor, so we spend a lot on cyber security. We still lost $50K to a very well executed spear phishing scam in January. It was perfectly constructed and hit us at a particularly vulnerable time.

The core of it was a fake invoice, CC'd to the accounts payable clerk as part of a conversation with the CEO asking for it to be paid. The conversation was fake, but looked very real. Great attention to detail was paid to making the fake email trail look perfect. It included bank info, ACH instructions, and a completed IRS form W9. The return address was to a real company, but with one letter omitted in a way that was not easily noticeable.

It came on 10 January, back dated 60 days. As some of you know, that is crunch time to get the books closed for EOY. Some companies also game their payment timing to reduce taxes.

We had procedures in place to prevent this, but some dysfunction in our financial shop caused those to break down. We replaced our CFO since this happened, which should fix the issues.
 
DaleB said:
Tools and management systems do exist to prevent users from installing software and to keep things up to date, but they’re expensive. Not only is the licensing expensive, but you need trained people to run them. It still won’t stop people from being tricked into leaking information, or doing it intentionally, or inadvertently giving away access to people who shouldn’t have it.

I used both Microsoft’s tools (Intune or whatever its name is this month) and Apple’s answer (which doesn’t come from Apple; you have to buy Jamf or Kandji or whatever). Both suck. Then we had numerous other tools that all had agents installed for security.

And none of it prevents your “people team” from hiring a fake person who turns out to be remotely operating one of your company laptops from North Korea, where their salary ends up supporting Dear Leader’s regime.
Click to expand...
You're 100% right that they suck. And as I'm sure you are aware, always have. I would characterize the tools as generally reducing the chances of unwanted software being installed on the computers. Because as you know if you're running those tools, the OS itself is basically wide open from a console perspective, and it's added layers that attempt to add more controls. The extreme example for Windows would be trying to make one into a kiosk that still has a functional keyboard. Every study I've heard of has a red team breaking into one in about a minute and a half. It's designed to be open and free and share everything with everyone, and it does that whether we want it to or not.

Contrast that to an old VT-100 terminal, or a FIPS 140-2 rated USB drive. With either of those, you're not modifying the software without physically breaking them open.

The current state of cyber security on the desktop is relying on some hope of user training, combined with 24/7 monitoring to try to catch something bad before it spreads too quickly, combined with EDR and NDR (endpoint detect respond, network detect respond) software, and people are still losing sleep over it, because everyone knows we're relying WAY too much on EDR right now.

In my highly cynical view, the only people making money from "innovation" in desktop office software are the people selling it. Changing it, adding to it, never getting it right, having it patched every other week or so, is the biggest drain on western economies we've ever had. There are plenty of lower layer IT standards that haven't changed much in 20 years. There's no reason why the application layer and HTML presentation layer can't be locked in and standardized just as much as a NEMA electrical socket. IT companies driving tech forward is the tail wagging the dog at everyone's expense but theirs.
 
You must log in or register to reply here.
Back
Top